What can be used as an indicator of compromise?

Hey, I’m doing some research for a project i want to take a look at, and i wanted to know how i can determine through custom software weather or not a computer system or network is being compromised by an attacker, and what patterns to look for when determining an attack method.